UvaWeb
Back to home

Privacy Policy

Last updated: 10 August 2026

Not yet reviewed by a lawyer.This describes what the product actually does today, as researched against current GDPR requirements, but hasn't been checked by qualified counsel and contains a few fields (marked [FILL IN]) only the business owner can supply.

1. Who this policy covers

This policy explains how UvaWeb collects and uses personal data when you sign up, use the studio, or contact support. See our Imprint page for who the data controller is.

2. What we collect

  • Account data: email, name (optional), password (hashed, never stored in plain text) or Google account identifier.
  • Business data you enter for your clients: names, niche, contact details, brand voice notes.
  • Media you upload for a client (photos, video) to be used in generation.
  • Generated content: websites, posts, images, and their edit history.
  • Support chat messages you send us.
  • Technical data: IP address at signup (used only to limit trial abuse), login timestamps, error logs.
  • Payment data: for manual bank transfer or PayPal-to-email payments, we see the reference code and amount you tell us you sent, not your card or full bank details. We never store card numbers.

3. Lawful basis for processing

  • Contract (GDPR Art. 6(1)(b)): account data, generated content, and billing information, to provide the service you signed up for.
  • Legitimate interest (Art. 6(1)(f)): signup IP, used narrowly to reduce trial-credit abuse; support messages, to answer them.
  • Consent(Art. 6(1)(a)): anything not covered above that we ask you to opt into separately, such as marketing email, if we ever add it (we don't send any today).
  • Legal obligation (Art. 6(1)(c)): payment records, kept for tax and accounting purposes.

4. How we use it

To create and run your account, generate content for your clients, process payments, respond to support requests, and secure the service against abuse (like the signup-IP check for trial eligibility). We don't use your data for advertising, and we don't sell it.

5. Who we share it with

We use these sub-processors, each only for what's needed to run the service:

  • Resend, to send verification, password-reset, and payment-instruction emails.
  • Anthropic and/or OpenAI, to generate website copy, captions, and ad text from your prompts.
  • Taisly, to publish approved content to a client's connected Facebook/Instagram accounts (Agency plan).
  • Pexels, for stock photo/video search when a client's own media doesn't cover a shot.
  • PayPal, for payment where you choose to pay that way (we never see your PayPal password or full account details).
  • Our hosting and database provider, [FILL IN: Vercel / your database host], to run the application and store data.

We never sell your data to third parties.

6. Your rights (GDPR)

If you're in the EU (or covered by GDPR generally), you have the right to:
  • Access a copy of your data (see the export option in Account settings, or ask us).
  • Correct inaccurate data (editable directly in your account or client records).
  • Delete your account and associated data (see Account settings, or ask us).
  • Export your data in a portable format (same export option).
  • Object to processing based on legitimate interest, or withdraw consent where that's the basis.
  • Lodge a complaint with your local data protection authority.

We respond to rights requests within 30 days. Email UvaWeb.info@gmail.com for anything not self-serve in your account settings.

7. Data retention

We keep account and client data for as long as your account is active. If you delete your account, we delete your personal data and client content within 30 days, except payment records, which we keep for [FILL IN: your jurisdiction's statutory bookkeeping period, typically 5–10 years] to meet accounting and tax obligations. Verification tokens and password-reset links expire and are deleted automatically within hours of being issued.

8. Cookies

UvaWeb currently sets only strictly necessary cookies: one to keep you signed in. We don't use analytics, advertising, or tracking cookies today. If that changes, we'll ask for your consent first with a cookie banner that lets you decline anything non-essential, and update this section.

9. International transfers

Some sub-processors above may process data outside the EU/EEA (for example, U.S.-based providers). Where that happens, we rely on their Standard Contractual Clauses or equivalent safeguard as their transfer mechanism.

10. Changes to this policy

We'll post any changes here with an updated date, and email active users about material changes.

11. Contact

Questions about this policy, or to exercise a data right: UvaWeb.info@gmail.com or WhatsApp/SMS +421 902 708 787.